From TechRadar · · 1m 20s
Brazilian banking malware hijacks Chrome and Edge browsers
New campaign uses fake documents to install malicious extensions that steal credentials and session data from bank customers.
In brief
New campaign uses fake documents to install malicious extensions that steal credentials and session data from bank customers. A Brazilian malware campaign called Kremlin uses fake business documents to install malicious browser extensions that steal banking credentials, primarily targeting users in Brazil. Originally…
New Brazilian banking malware found
Elastic Security Labs discovered REF9334, a campaign active since May 2025 that uses fake banking and business documents to trick victims into installing malware.
Malicious browser extensions deployed
The malware, named Kremlin, installs fake extensions in Chrome and Edge browsers. It steals credentials, cookies, session data, and takes screenshots of banking websites.
Clever tricks to avoid detection
Kremlin checks if it's running in a sandbox and won't execute if detected. It disguises itself as an antivirus addon called AVSync System Inc.
Uses blockchain to hide communications
Instead of a fixed command server, the malware stores information on the Ethereum blockchain. This makes it much harder to disrupt communication with infected machines.
Over 1,500 systems infected
Researchers took control of a malware domain and found 1,515 infected systems. Nearly all victims, 98%, were located in Brazil.
Researchers disrupted the campaign
By registering a canary domain, Elastic made the malware think it was in a sandbox. This prevented infections from progressing past initial access.
“the infections have not moved past the initial access”
At a glance
A Brazilian malware campaign called Kremlin uses fake business documents to install malicious browser extensions that steal banking credentials, primarily targeting users in Brazil.
